Type of personal data information system. Personal data information systems

Information Systems Personal data (ISPD) is used by many enterprises and organizations in their work. Let's figure out what it is and what nuances need to be taken into account by those who work with ISPD.

What is ISPDN?

To put it simply, the ISPD information system is used to store and process personal data. It consists of the following components:

• Actually, a set of personal data stored in the system, in a database.
• Technical means used to work with this data.
• Tools for automating the processes of accounting and processing information stored in ISPD (may not be available in all systems).

IPDN is serious

When using the systems in question, it is important to ensure the protection of personal data from unauthorized access, loss and other emergency situations. This is even prescribed at the legislative level. And in order to take recommended measures to limit access to information and protect it, an ISPD audit is carried out (more details can be found, for example, from the specialists of the Rentacloud company: http://rentacloud.su/services/zashchita-personalnykh-dannykh /audit/). Based on its results, a report is drawn up containing the following information:

• Category of personal data that is stored and processed in the surveyed system.
• Their class and type (more on this below).
• Parameters and structure of the system under study.
• Volumes of PD (number of records, etc.) stored and processed in the ISPD.
• Information about the location of the system.
• Information about the possibility of accessing the database through networks accessible to common use(LAN, Internet, etc.).

The audit is carried out in strict accordance with joint document, prepared by the Ministry of Communications, FSTEC and FSB. It is very voluminous and requires thorough study. In this regard, the audit of the system and the preparation of recommendations on which the protection of ISPD will be based must be trusted to specialists. You can use their services, for example, by contacting the company “Rentacloud”: (http://rentacloud.su).

Types, classes of ISPD, and what else you need to know about such systems

Personal data information systems (PDI) are divided into 4 classes and 2 types. The division into classes is carried out on the basis of such characteristics as the category of processed personal data and their volumes.

Classes

The table will help you figure this out:

Explanations for the table.

Category number 4 includes anonymized personal data, by which it is impossible to identify a specific subject (example - statistical data). Category 3 includes PD on the basis of which only identification of a person is possible (they are quite rare). Category 2 includes data on the basis of which it is possible to identify a person and obtain certain information about him additional information(example: payroll systems in organizations and enterprises). The first category includes data containing information about nationality, health status and other social information, and information of a different nature (for example, databases of health care institutions).

As for the classes indicated in the table, the assignment of ISDN to them is carried out on the basis of possible damage to subjects in case of violation of security conditions:

• Class 4. Any negative consequences for the subject are excluded.
• Cl 3. Minor negative consequences may occur.
• Cl 2. The occurrence of such consequences.
• Cl 1. Very serious negative consequences are possible.

Types of ISPD

The first type includes systems where the ISPD protection functions are reduced only to achieving necessary indicators her privacy. If, in addition to confidentiality, there is a need to ensure at least one additional security indicator (authenticity, availability, data integrity, etc.), we're talking about about the second type.

It is worth noting that most of the systems used today are classified as the second type.

It can be seen that the development of ISPD, their classification and provision of reliable, effective protection– very complex and multifaceted processes. And in order to avoid mistakes, it is advisable to entrust this to specialists. To do this, you can contact, for example, the Rentacloud company, which occupies one of the leading positions in this market.

One of the priority activities that needs to be carried out when creating an information system for processing personal data (ISPD) is the classification of ISPD.

This is necessary in order to determine the class of the system and the corresponding requirements imposed by FSTEC and the FSB when processing personal data (PD). In this article I will describe the general procedure for classifying ISPD.

In accordance with the Order of FSTEC/FSB/Ministry of Communications dated 02/13/2008 No. 55/86/20 on the “Procedure for Classification of Personal Data Information System”, which can be downloaded here, the required classification includes the following steps:

• Collection and analysis of initial data on the information system;
• Assignment of the appropriate class to the information system and its documentation.

When classifying an information system, it is necessary to answer the following questions:

1. 1Which category does the personal data processed in the information system belong to? XPD?
2. What is the volume of personal data processed (number of personal data subjects whose personal data is processed in the information system) – Xnpd?
3. What are the specified security characteristics of personal data processed in the information system?
4. What is the structure of the information system?
5. Is there a connection of the information system to public communication networks and/or Internet networks?
6. What is the regime for processing personal data?
7. What is the mode for delimiting access rights of users of the information system?
8. Location of technical means of the information system?

Background and supporting information

The following categories of personal data processed in the information system (XPD) are defined:

1. category 1- personal data relating to race, nationality, political views, religious and philosophical beliefs, health status, intimate life;
2. category 2- personal data that allows you to identify the subject of personal data and obtain information about him Additional information, with the exception of personal data related to category 1;
3. category 3- personal data allowing identification of the subject of personal data;
4. category 4- anonymized and (or) publicly available personal data.

Xnpd can take the following values:

• 1 - the information system simultaneously processes personal data of more than 100,000 personal data subjects or personal data of personal data subjects within the subject Russian Federation or the Russian Federation as a whole;
• 2 - the information system simultaneously processes personal data from 1,000 to 100,000 personal data subjects or personal data of personal data subjects working in the economic sector of the Russian Federation, in a government agency, living within a municipality;
• 3 - the information system simultaneously processes data of less than 1000 personal data subjects or personal data of personal data subjects within a specific organization.

Personal data security characteristics

For ISPD, the security characteristics of personal data are determined, which are divided into basic and additional:

BASIC:

• confidentiality
• integrity
• availability

ADDITIONAL:

• non-repudiation
• accounting (controllability)
• authenticity (reliability)
• adequacy

Information system structure divided into:

• autonomous (not connected to other information systems) complexes of technical and software devices intended for processing personal data (automated workstations);
• a complex of automated workstations combined into a single information system by means of communication without the use of technology remote access(local information systems);
• a complex of automated workstations and (or) local information systems, combined into a single information system by means of communication using remote access technology (distributed information systems).

Processing mode

When organizing ISPD, the following processing modes are determined:

• single-user;
• multi-user.

Access rights control mode

In ISPD, the access control system implies:

• without differentiation of access rights;
• with differentiation of access rights.

Information systems are divided into typical And special.
Towards a standard information system These include systems that require only confidentiality of personal data.

Towards a special information system These include systems that, in addition to confidentiality, require:

• Information systems in which personal data relating to the health status of the subjects of personal data are processed;
• Information systems in which, based solely on automated processing personal data provides for the adoption of decisions that give rise to legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests.

Information system classification

According to FSTEC/FSB/Ministry of Communications Order No. 55/86/20, ISPDn can take one of four classes defined in this order:

1. class 1 (K1)— information systems for which violation given characteristics the security of personal data processed therein may lead to significant negative consequences for the subjects of personal data;
2. class 2 (K2)- information systems for which violation of the specified security characteristics of personal data processed in them may lead to negative consequences for the subjects of personal data;
3. class 3 (K3)— information systems for which a violation of the specified security characteristics of personal data processed in them may lead to minor negative consequences for the subjects of personal data;
4. class 4 (K4)— information systems for which violation of the specified security characteristics of personal data processed in them does not lead to negative consequences for the subjects of personal data.

Priest November 9, 2010 at 12:31 pm

Personal data (ISPD Classification)

• Lumber room *

A lot has been written about the classification of personal data information systems: entire articles, websites and forums are devoted to this burning topic. Let's start with the fact that in accordance with the order of FSTEC\FSB\MITiS No. 55\86\20 there are typical And special ISPDn. Typical ISPDs include those in which it is necessary to ensure only the confidentiality of personal data, and special ones - if it is necessary to ensure at least one of the security characteristics of personal data other than confidentiality (integrity, authenticity, accessibility, etc.)
The order involves the classification of ISPD based on an assessment of the possible damage to the PD subjects whose data is processed in it: the higher the possible damage, the higher the class and, accordingly, the higher the requirements for technical protection. Paragraph 14 of the Order speaks of 4 classes:
-absence of negative consequences (grade 4)
-minor negative consequences (grade 3)
-negative consequences (grade 2)
- significant negative consequences (grade 1).
The assignment of one or another ISPD class, according to the same paragraph, is carried out based on the results of the analysis of the source data.
The classification of standard ISPDs has already been discussed here, so let’s move straight to the special ones.

How to classify a special ISPD?

If your ISPD contains personal data related to race, nationality,
political views, religious and philosophical beliefs, health status, intimate life, then everything is simple:
your system class is K1. And it doesn’t matter whether there are 10 records or 100,000. Next, you either protect the system according to K1 in accordance with the requirements of FSTEC Order No. 58, or downgrade the class, for example, by depersonalizing such data.
Now let’s imagine a certain ISPD that we need to classify. Let it be a large enterprise that provides services to its Clients.
Initial data of our system:
1. Scope of personal data- more than 100,000.
2. Category of personal data- 2 (i.e. this is personal data that allows you to identify the subject of personal data and obtain additional information about him).
3. Information system structure- distributed;
4. Availability of connections information system to public communication networks and (or) international networks information exchange- There is;
5. Personal data processing mode- multi-user;
6. Access rights control mode users of the information system - with differentiation of access rights;
7. Location of technical equipment information system - within the Russian Federation.

But we cannot classify such a system according to the plate from order No. 55\86\20, because “According to the results of the analysis of the initial data typical the information system is assigned one of the following classes.” Don’t get upset, we read the order further and see the following point:
16. Based on the results of the analysis of source data, the class of a special information system is determined on the basis of a model of threats to the security of personal data in accordance with methodological documents developed in accordance with paragraph 2 of the Decree of the Government of the Russian Federation of November 17, 2007 N 781 “On approval of the Regulations on ensuring security personal data when processed in personal data information systems"
Therefore, having analyzed the source data, the composition of the processed PD, determining the structure of the ISPD and technological processes, we can come to reasonable conclusion, What Negative consequences may violate the confidentiality of information (for example, disseminating information about an employee’s disability). The implementation of all other threats will lead to minor negative consequences, because sufficient technical protection measures have been taken (or will be taken in the future during the creation of the ISPD protection system) to neutralize them. Having reflected this information in the threat model, a special ISPD with the specified characteristics can be easily classified by us as K2.

Tags: personal data, ispdn

Registration No. 11462

In accordance with paragraph 6 of the Regulations on ensuring the security of personal data during their processing in personal data information systems, approved by Decree of the Government of the Russian Federation of November 17, 2007 N 781 “On approval of the Regulations on ensuring the security of personal data during their processing in personal data information systems "(Collected Legislation of the Russian Federation, 2007, No. 48, Part II, Art. 6001), we order:

Approve the attached Procedure for the classification of personal data information systems.

Director

Federal service

on technical and export control

S. Grigorov

Director of the Federal Security Service

Russian Federation

N. Patrushev

Minister information technologies and communications of the Russian Federation

L. Reiman

The procedure for classifying personal data information systems

1. This Procedure determines the classification of personal data information systems, which are a set of personal data contained in databases, as well as information technologies and technical means that allow the processing of such personal data using automation tools (hereinafter referred to as information systems)1.

2. Classification of information systems is carried out government agencies, municipal authorities, legal and individuals, organizing and (or) carrying out the processing of personal data, as well as determining the purposes and content of the processing of personal data (hereinafter referred to as the operator)2.

3. The classification of information systems is carried out at the stage of creating information systems or during their operation (for previously put into operation and (or) modernized information systems) in order to establish methods and means of protecting information necessary to ensure the security of personal data.

4. Carrying out the classification of information systems includes the following steps:

collection and analysis of initial data on the information system:

assignment of the appropriate class to the information system and its documentation.

5. When classifying an information system, the following initial data are taken into account:

volume of personal data processed (number of personal data subjects whose personal data is processed in the information system) - X npd;

security characteristics of personal data processed in the information system specified by the operator;

information system structure;

availability of connections of the information system to public communication networks and (or) international information exchange networks;

personal data processing mode;

mode of delimiting access rights of users of the information system;

location of technical means of the information system.

6. The following categories of personal data processed in the information system (XPD) are defined:

7. X npd can take the following values:

1 - the information system simultaneously processes personal data of more than 100,000 personal data subjects or personal data of personal data subjects within a constituent entity of the Russian Federation or the Russian Federation as a whole;

2 - the information system simultaneously processes personal data from 1,000 to 100,000 personal data subjects or personal data of personal data subjects working in the economic sector of the Russian Federation, in a government body, living within a municipality;

3 - the information system simultaneously processes data of less than 1000 personal data subjects or personal data of personal data subjects within a specific organization.

8. According to the security characteristics of personal data processed in the information system specified by the operator, information systems are divided into standard and special information systems.

Typical information systems are information systems that require only ensuring the confidentiality of personal data.

Special information systems are information systems in which, regardless of the need to ensure the confidentiality of personal data, it is necessary to ensure at least one of the security characteristics of personal data other than confidentiality (security from destruction, modification, blocking, as well as other unauthorized actions).

Special information systems should include:

information systems in which personal data relating to the health status of the subjects of personal data are processed;

information systems that provide for the adoption, based solely on automated processing of personal data, of decisions that give rise to legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests.

9. According to their structure, information systems are divided into:

for autonomous (not connected to other information systems) complexes of hardware and software designed for processing personal data (automated workstations);

to complexes of automated workstations integrated into a single information system by means of communication without the use of remote access technology (local information systems);

to complexes of automated workstations and (or) local information systems, combined into a single information system by means of communication using remote access technology (distributed information systems).

10. Based on the presence of connections to public communication networks and (or) international information exchange networks, information systems are divided into systems with connections and systems without connections.

11. According to the mode of processing personal data in the information system, information systems are divided into single-user and multi-user.

12. Based on the delimitation of user access rights, information systems are divided into systems without delimitation of access rights and systems with delimitation of access rights.

13. Information systems, depending on the location of their technical means, are divided into systems, all technical means which are located within the Russian Federation, and systems, the technical means of which are partially or entirely located outside the Russian Federation.

14. Based on the results of the analysis of source data, a typical information system is assigned one of the following classes:

class 1 (K1) - information systems for which a violation of the specified security characteristics of personal data processed in them can lead to significant negative consequences for the subjects of personal data;

class 2 (K2) - information systems for which a violation of the specified security characteristics of personal data processed in them may lead to negative consequences for the subjects of personal data;

class 3 (K3) - information systems for which a violation of the specified security characteristics of personal data processed in them may lead to minor negative consequences for the subjects of personal data;

class 4 (K4) - information systems for which violation of the specified security characteristics of personal data processed in them does not lead to negative consequences for the subjects of personal data.

15. The class of a typical information system is determined in accordance with the table.

16. Based on the results of the analysis of source data, the class of a special information system is determined on the basis of a model of threats to the security of personal data in accordance with methodological documents developed in accordance with paragraph 2 of the Decree of the Government of the Russian Federation of November 17, 2007 N 781 “On approval of the Regulations on ensuring security personal data when processed in personal data information systems"3.

17. If subsystems are identified within an information system, each of which is an information system, the information system as a whole is assigned a class that corresponds most high class subsystems included in it.

18. The results of the classification of information systems are documented in the corresponding act of the operator.

19. The information system class can be revised:

by decision of the operator based on his analysis and assessment of threats to the security of personal data, taking into account the characteristics and (or) changes of a specific information system;

based on the results of measures to monitor compliance with the requirements for ensuring the security of personal data during their processing in the information system.

1Paragraph one of paragraph 1 of the Regulations on ensuring the security of personal data during their processing in personal data information systems, approved by the Decree of the Government of the Russian Federation of November 17, 2007.

N 781 (Collection of Legislation of the Russian Federation, 2007, N 48, part II,

2Paragraph one of clause 6 of the Regulations.

3Collected legislation of the Russian Federation 2007, N 48, part II,Art. 6001.